feat(cloudfront): verify acm certificate is in us-east-1

packages/@aws-cdk/aws-cloudfront/lib/web_distribution.ts

@@ -656,6 +656,14 @@ export class CloudFrontWebDistribution extends cdk.Construct implements IDistrib
       const sslSupportMethod = props.aliasConfiguration.sslMethod || SSLMethod.SNI;
       const acmCertificateArn = props.aliasConfiguration.acmCertRef;
 
+      if (acmCertificateArn) {
+        const {region} = cdk.Arn.parse(acmCertificateArn);
+
+        if (!cdk.Token.isUnresolved(region) && region !== 'us-east-1') {
+          throw new Error(`acmCertificateArn must be in the 'us-east-1' region, got '${region}'`);
+        }
+      }
+
       distributionConfig = {
         ...distributionConfig,
         aliases: props.aliasConfiguration.names,

packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-security-policy.expected.json

@@ -51,7 +51,7 @@
           ],
           "PriceClass": "PriceClass_100",
           "ViewerCertificate": {
-            "AcmCertificateArn": "testACM",
+            "AcmCertificateArn": "arn:aws:acm:us-east-1:1234567890:certificate/testACM",
             "MinimumProtocolVersion": "TLSv1",
             "SslSupportMethod": "sni-only"
           },

packages/@aws-cdk/aws-cloudfront/test/integ.cloudfront-security-policy.ts

@@ -23,7 +23,7 @@ new cloudfront.CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
     }
   ],
   aliasConfiguration: {
-    acmCertRef: 'testACM',
+    acmCertRef: 'arn:aws:acm:us-east-1:1234567890:certificate/testACM',
     names: ['test.test.com'],
     sslMethod: cloudfront.SSLMethod.SNI,
     securityPolicy: cloudfront.SecurityPolicyProtocol.TLS_V1

packages/@aws-cdk/aws-cloudfront/test/test.basic.ts

@@ -1,4 +1,5 @@
 import { expect } from '@aws-cdk/assert';
+import certificatemanager = require('@aws-cdk/aws-certificatemanager');
 import s3 = require('@aws-cdk/aws-s3');
 import cdk = require('@aws-cdk/core');
 import { Test } from 'nodeunit';
@@ -325,4 +326,62 @@ export = {
     test.done();
   },
 
+  'throws if certificate is not in us-east-1 - fromCertificateArn'(test: Test) {
+    // GIVEN
+    const stack = new cdk.Stack();
+    const sourceBucket = new s3.Bucket(stack, 'Bucket');
+    const certificate = certificatemanager.Certificate.fromCertificateArn(
+        stack, 'EuCertificate', 'arn:aws:acm:eu-west-1:1234567890:certificate/testACM'
+    );
+
+    // WHEN
+    const toThrow = () => {
+      new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
+          originConfigs: [
+          {
+            s3OriginSource: {s3BucketSource: sourceBucket},
+            behaviors: [{isDefaultBehavior: true}]
+          }
+        ],
+        aliasConfiguration: {
+          names: ['www.example.com'],
+          acmCertRef: certificate.certificateArn
+        }
+      });
+    };
+
+    // THEN
+    test.throws(() => toThrow(), /acmCertificateArn must be in the 'us-east-1' region, got 'eu-west-1'/);
+    test.done();
+  },
+
+  'throws if certificate arn is invalid - constructor'(test: Test) {
+    // GIVEN
+    const app = new cdk.App();
+    const stack = new cdk.Stack(app, 'RegionStack', {env: {region: 'eu-west-3'}});
+    const sourceBucket = new s3.Bucket(stack, 'Bucket');
+    const certificate = new certificatemanager.Certificate(stack, 'TestCertificate', {
+      domainName: 'www.example.com',
+    });
+
+    // WHEN
+    const toThrow = () => {
+      new CloudFrontWebDistribution(stack, 'AnAmazingWebsiteProbably', {
+        originConfigs: [
+          {
+            s3OriginSource: {s3BucketSource: sourceBucket},
+            behaviors: [{isDefaultBehavior: true}]
+          }
+        ],
+        aliasConfiguration: {
+          names: ['www.example.com'],
+          acmCertRef: certificate.certificateArn
+        }
+      });
+    };
+
+    // THEN
+    test.throws(() => toThrow(), /acmCertificateArn must be in the 'us-east-1' region, got 'eu-west-3'/);
+    test.done();
+  },
 };